Brian Jackson - Fotolia

ICO finds Metropolitan Police's Gangs Matrix seriously breaches data protection laws

A year-long ICO investigation has highlighted major problems with how the Metropolitan Police handles and shares the personal data of individuals on its Gangs Matrix

An investigation into the Gangs Matrix, a police intelligence database used to identify and monitor individuals considered to be linked to gangs, finds that the Metropolitan Police Service’s (MPS) use of the tool has led to serious breaches of data protection laws.

The Information Commissioner’s Office (ICO) began their investigation in October 2017 after concerns were raised by Amnesty International, and has now issued a lengthy 27-page Enforcement Notice compelling the MPS to comply with data protection laws within six months.

The notice highlights an array of problems with how the MPS uses the Matrix, which includes but is not limited to: the complete absence of an Equality Impact Assessment, a lack of central oversight or governance over the processing of the data, and the blanket sharing of sensitive personal data with third parties despite the absence of any information sharing agreements.

“There is no evidence that the MPS considered at any time the obvious privacy/data protection and equality impacts arising from the processing, whether by formal Impact Assessments or otherwise,” reads the notice. “Basic data protection practice… has not been followed.”

The ICO has concluded the data sharing “goes beyond what is reasonably necessary to achieve the MPS’s legitimate purposes in preventing and detecting crime and prosecuting offenders. There is no necessity for the MPS to share such large amounts of personal data to such a wide array of third parties.”

In response to the Enforcement Notice, the Met has said it will continue to use the Gangs Matrix, adding: “We have already started work to ensure that we improve our data handling and information sharing with partners, who are also involved in community safety work.

“As well as addressing the concerns within the ICO report, we are also taking forward additional work including the introduction of a public-facing website to explain the legal framework for the Gangs Matrix, and further information to improve public confidence and transparency. We have a constructive relationship with the ICO and will continue to work with them as we go forward.”

As of yet, there are no mechanisms through which people on the Matrix can challenge their inclusion, and there appears to be no formal process in place to alert them that they have even been placed on it in the first place.

The lack of these mechanisms contravene a data subject’s right to access any information held on them, as well as their right to erasure of inaccurate personal data.

Many on the database have only discovered their inclusion by chance, such as when going for job interviews, which they were turned away from due to being under police surveillance, or when facing threat of eviction by local authorities.

Inclusion on the Matrix can therefore have wide-ranging repercussions on an individual’s life, with many feeling unable to speak to journalists or even policy makers for fear of reprisals, according to Katrina Ffrench, CEO of StopWatch, a coalition that works to promote effective, accountable and fair policing, and is in contact with individuals on the Matrix.

How does it work?

When individuals are placed on the Matrix, they are assigned an automated risk score, known as a “harm score”, based on police information about past arrests, convictions and any other relevant intelligence.

Once a harm score has been assigned, each so-called “gang nominal” is then labelled as red, amber or green. Those with a red label are deemed most likely to commit a violent offence, while green nominals pose the lowest risk.

However, an Amnesty International report, Trapped in the Matrix, found that 40% of people on the Matrix have a harm score of zero, meaning the police have no record of them being involved in a violent offence, while 64% of all individuals have been labelled green. It also found that 75% of the individuals had been a victim of violence themselves. Less than 5% of individuals were marked as red.

In the Enforcement Notice, the ICO show that use of the Matrix is dictated by the Gangs Operating Model and that, according to this model, “individuals should only be included in the Matrix if they meet the threshold definition as a gang nominal, and if they have been assessed through centralised Matrix scoring criteria, and if they reach the set threshold scores”.

It is unclear what the scoring criteria are and how the “intelligence” used affects this final score, with the MPS declining requests from Computer Weekly to provide further details on the methodology.

“The software treats that record of possible gang activity as a concrete piece of data, so it’s very unclear how the Gangs Matrix can actually rank the prominence, or the certainty, of this intelligence when it’s entered into a database it draws on,” said Jaime Grace, a senior lecturer in law at Sheffield Hallam University.

Both Amnesty and the ICO investigation also found that the Matrix disproportionately affects black, Asian and minority ethnic (Bame) people, with 78% of those listed in the database being black.

“Don’t get me wrong, the black community – like any other community – has issues, but to single us out and have specific police tools for us doesn’t help – I think it re-enforces stereotypes,” said Ffrench. The MPS declined to comment at all on the discriminatory nature of the Matrix when asked for further comment on this point by Computer Weekly.

Grace added: “Part of the problem with the Gang Matrix tool, one of the things that comes through loud and clear, is that individuals get stigmatised over a long period of time, and sometimes off the back of very, very sketchy police intelligence.”

Data quality

The use of the Matrix highlights a number of issues regarding the quality of the data being used to place and score people on the Matrix.

“How you get onto Matrix in the first place doesn’t seem to be entirely clear to us, and some things are quite problematic,” said Oliver Feeley-Sprague, Amnesty International UK’s arms control director, who was heavily involved in researching the Matrix.

“So when defending it, the police would say, ‘Well you know, we need several bits of independently corroborated evidence, we don’t just arbitrarily put someone on’, but they use the example of police reports being sufficient grounds.

“Lots of people on the Matrix are actually victims of a crime, or they’ve been subject to stop and search – not them maybe, but a colleague, they’re in a car that gets stopped so their names get taken, a name can appear in a police report for all sorts of reasons.”

Further information is also gathered by police using social media and through looking at an individual’s network of association, which are used as corroborating intelligence.

Read more about police data

“We certainly hear the number of testimonials from people on the Matrix that essentially said, ‘I think I’m only on this Matrix because of the area I grew up in and the kind of people the police think I hang around with’, so it’s guilty by association,” said Feeley-Sprague. “But it’s guilt by association based on very arbitrary decisions.”

The issue of using questionable intelligence to corroborate other items of questionable intelligence is compounded by confusion over the definition of what actually constitutes a gang, which itself raises doubts about the quality of data and information being used by police.

“There has been an emphasis on intelligence-led policing, however, from our perspective we’re concerned with what that actually means. Having looked at the Matrix database, we don’t believe that that is intelligent intelligence,” said Ffrench. “There’s some concern about how the police are framing what they’re doing and the basis they’re using to do it.”

For example, the MPS tracks a number of “gang indicators”, which are essentially different types of crime that they consider to be proxies for gang crime. The two most important in this context are serious youth violence (the victim is under 20) and knife crime in under-25s unrelated to domestic violence.

This has the effect of conflating youth violence in deprived areas with the highly structured offending of organised criminal gangs, when in reality gang crime represents only a small percentage of serious youth violence, according to figures from the Mayor’s Office for Policing and Crime (MOPAC).

Data sharing

Despite the fact that the data being used to justify people’s inclusion on the Matrix is of questionable integrity, the MPS still shares the information widely with a range of third parties.

These include the UK Border Agency, the Crown Prosecution Service, a number of housing associations and local authorities, schools and Jobcentres Plus.

Given the concerns over the accuracy of the information on the Matrix, the police’s intelligence sharing with any of these parties has the potential to negatively and unfairly affect the individuals on it. There are a number of well-evidenced examples of how this happens that are outlined in the Amnesty International report.

There are also major inconsistencies in how data is shared between boroughs, as implementation of the Operating Model is down to the 32 individual London boroughs.

“Each London borough has its own Matrix, and each borough would have a different policy to how they would share it,” said Feeley-Sprague. “So what should be very strictly adhered to rules were different depending on which borough you sat in.”

“One borough would essentially email their copy of the Matrix in advance of all meetings to anyone that was coming, while another borough decided that the information was sensitive so they would only project it on to the screen,” he added.

What’s next?

The ICO Enforcement Notice outlines a number of recommendations the MPS must take to ensure their compliance with data protection laws. These include conducting a data protection impact assessment (which has never been done), completing a full review of all data sharing to determine a legal basis for when it is acceptable, and carrying out regular audits to assess compliance with any new guidelines.

“The mere fact that it’s been confirmed they haven’t carried out an Equality Impact Assessment for seven years is an act of racism,” said Stafford Scott, a member of the Monitoring Group, who first made Amnesty aware of the database when a copy of the Haringey Matrix was leaked to him. “On this occasion, it was not unwitting, they were doing it specifically because they know the Matrix is racially loaded.”

When approached by Computer Weekly on this point, the MPS said it had nothing to add.

“It’s helpful that the ICO has also acknowledged that not only have police showed blatant disregard for data protection, but also disregard for the equality legislation,” said Scott.

A formal progress report on each of the recommended measures must be given to the ICO on a monthly basis, something Scott describes as being on “special measures” due to police having to regularly provide evidence for their actions.

“The police and MOPAC have carried out a stance of plausible deniability,” added Scott. “I’m extremely confident once you’ve seen the document the plausibility goes out the window, once the regulators get involved it’s over and done with, it’s worse than what they did with the sus laws – this cannot and will not survive.”

The sus laws were an extension of the 1824 Vagrancy Act that allowed police to stop and search, as well as arrest, anyone they suspected would commit a crime. It was used heavily the late 1970s and early 1980s against Britain’s black population.

“I would be amazed and surprised if the Matrix is still in use at the end of next year,” said Scott.

The ICO will be launching a second investigation that focuses on how the police’s partners handle information shared with them, and is currently investigating a data breach at Newham Borough Council involving the Matrix.

The MPS’s response to these investigations, as well as its efforts to comply with the latest findings, will be closely monitored.

Origins of the Matrix

After the fatal shooting of Mark Duggan by police in 2011, a series of riots erupted across England, beginning in Tottenham. In the immediate aftermath of the unrest, David Cameron’s government declared its “war on gangs”, who were said to be responsible for orchestrating the riots.

No subsequent reviews, including those by the MPS itself or the Riots, Communities and Victims Panel set up by Cameron, have ever been able to confirm any of the assertions made by senior government figures at the time that gangs were responsible.

Nevertheless, the political imperatives were clear, and by early 2012 the Gangs Matrix was operational.

Read more on Technology startups

Data Center
Data Management